The model's one rule is 'do not trust the run.' Authorization for one action never carries to the next: every action is judged against who the AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → is, which task it was authorized for, and which sensitive resources the run has already touched.
That last input is one-way. The Trust Ratchet only removes capability — once a run reads something protected, it permanently loses matching powers, and it gets them back only in a freshly authorized task. Not a policy check, a state machine.
The strategic inversion: most work tries to make each access decision smarter. This makes the agent's capability smaller so there is less to judge. Shrinking the blast radius scales better than growing the judge.
A prompt is not a perimeter. 'Never touch production' shapes behavior but enforces nothing, since injected content in whatever the agent reads can steer it. Enforcement has to live in the agent harnessThe scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.Full definition → that mediates tool calls and the network that mediates packets.
A practical gap in today's standards: DPoP (RFC 9449) binds a tokenThe chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.Full definition → to a key but its proof covers only the HTTP method and target URL — not the body, query string, or tool arguments. So the harness must authorize an immutable request and then execute that exact request.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
agent harness — The scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.
token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.
Why it matters
Gives engineers deploying task-scoped agents a concrete access model to reason about, instead of stretching BeyondCorp assumptions that were built for humans at human speed.
Key quotes
“The controls we built for humans do not fail loudly when we point them at agents. They fail quietly, by granting too much, seeing too little, and trusting for too long.”
“A boundary you can talk your way past is not a boundary.”
“An agent that has read a system of record while retaining an outbound path can exfiltrate data at machine speed.”
“The lifetime of the credential should match the lifetime of the task. For an agent, that is often minutes.”
“An approval that is always granted is not a control. It is a ritual that trains people to ignore the one prompt that matters.”
